Node ajv: fast-uri is a URI parser for Node.js. (CVE-2026-75975)

The fast-uri library for Node.js contains a vulnerability (CVE-2026-75975) in its IPv6 bracketed literal parser. The parser does not fully validate the IPv6 grammar, allowing invalid trailing text in the authority component to be silently discarded. This causes malformed attacker-controlled hosts to be transformed into different valid IPv6 addresses, such as the unspecified address (::) or private-range addresses. Because no error is set on the parsed result, applications relying on error checks may not detect this rewrite. This flaw can be exploited in scenarios where untrusted URLs are normalized before outbound HTTP requests, redirects, proxy routing, or address-policy enforcement, enabling server-side request forgery and address-policy bypass. The issue affects fast-uri versions 2.3.1 to <2.4.5, 3.0.0 to <3.1.6, and 4.0.0 to <4.1.3. The vulnerability is fixed in versions 2.4.5, 3.1.6, and 4.1.3 by validating bracketed IP literals against the full grammar and marking malformed literals as authority errors.

This vulnerability allows an attacker to craft malformed IPv6 URIs that are normalized to unintended valid IPv6 addresses, such as local loopback or private network addresses. This can cause applications that normalize URLs before making outbound HTTP requests or performing routing to connect to internal or restricted network services instead of the intended external hosts. The impact is server-side request forgery (SSRF) and bypass of address-policy enforcement, potentially exposing internal services to unauthorized access. The CVSS score is 7.5 (High), indicating significant risk due to the potential for information disclosure or unauthorized internal network access.

A fix is available. Users should upgrade fast-uri to versions 2.4.5, 3.1.6, or 4.1.3 or later, which properly validate bracketed IPv6 literals and reject malformed addresses with errors. Applying these updates will prevent silent normalization of invalid IPv6 addresses and mitigate the risk of SSRF and address-policy bypass. No additional mitigation steps are indicated by the vendor advisory.